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^ ! Abstract 

| A parametric down-conversion (PDC) source can be used as either a triggered single photon 

source or an entangled photon source in quantum key distribution (QKD). The triggering PDC 
QKD has already been studied in the literature. On the other hand, a model and a post-processing 
protocol for the entanglement PDC QKD are still missing. In this paper, we fill in this important 
gap by proposing such a model and a post-processing protocol for the entanglement PDC QKD. 
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Although the PDC model is proposed to study the entanglement-based QKD, we emphasize that 

(N 



our generic model may also be useful for other non-QKD experiments involving a PDC source. 
Since an entangled PDC source is a basis independent source, we apply Koashi-PreskilFs security 
analysis to the entanglement PDC QKD. We also investigate the entanglement PDC QKD with 
two-way classical communications. We find that the recurrence scheme increases the key rate and 
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Gottesman-Lo protocol helps tolerate higher channel losses. By simulating a recent 144km open-air 
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PDC experiment, we compare three implementations — entanglement PDC QKD, triggering PDC 
QKD and coherent state QKD. The simulation result suggests that the entanglement PDC QKD 
can tolerate higher channel losses than the coherent state QKD. The coherent state QKD with 
decoy states is able to achieve highest key rate in the low and medium-loss regions. By applying 
Gottesman-Lo two-way post-processing protocol, the entanglement PDC QKD can tolerate up to 
70dB combined channel losses (35dB for each channel) provided that the PDC source is placed in 
between Alice and Bob. After considering statistical fluctuations, the PDC setup can tolerate up 
to 53dB channel losses. 
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I. INTRODUCTION 



There are mainly two types of quantum key distribution (QKD) schemes. One is the 
prepare-and- measure scheme such as BB84 111 and the other is the entanglement based 

n 

QKD such as Ekert91 [2J. The security of both types of QKD has been proven in the last 
decade, see for example, 0, 4, 5]. For a review of quantum cryptography, one may refer 
to Q|. Meanwhile, researchers have also proven the security of QKD with realistic devices, 
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In the original proposal of the BB84 protocol, a single photon source is required. Unfor- 
tunately, single photon sources are still not commercially available. Instead, a weak coherent 
state source is widely used as an imperfect single photon source. Throughout this paper, we 
call this implementation as coherent state QKD. Many coherent state QKD experiments have 
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been performed since the first QKD experiment [14j, see for example 

Decoy state method [21] has been proposed as a useful method for substantially improving 
the performance of the coherent state QKD. The security of QKD with decoy states has 



been proven 
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24j. Asymptotically, the coherent state QKD with decoy states is 



able to operate as good as QKD with perfect single photon sources in the sense that the 
cey generation rates given by both setups linearly depend on the channel transmittance 



24] . Afterwards, some practical decoy-state protocols are proposed 
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experimental demonstrations for decoy state method have been done recently 
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34j . Other than decoy state method, there are other approaches to enhance the 



performance of the coherent state QKD, such as QKD with strong reference pulses 35], 136] 



and differential-phase-shift QKD 

Besides the coherent source, there is another source that can be used for QKD — para- 
metric down-conversion (PDC) source. With a PDC source, one can realize either prepare- 
and-measure or entanglement-based QKD protocols. To implement a prepare-and-measure 
QKD protocol, one can use a PDC source as a triggered single photon source. To imple- 
ment an entanglement-based QKD protocol, on the other hand, one can use the polarization 
entanglement between two modes of the light emitted from a PDC source. We call these 
two implementations triggering PDC QKD and entanglement PDC QKD. With a entangled 
source, one can also implement QKD protocols based on causality [38] and Bell's inequality 
39]. 
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The model and post-processing of the triggering PDC QKD have already been studied 
Recently, there are some practical decoy state proposals for the triggering PDC QKD 
42]. In this paper, we will focus on the asymptotic decoy state protocol [24j], which 
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is the upper bound of all these practical decoy state protocols when threshold detectors are 
used by Alice and Bob. 

On the other hand, the model and post-processing for the entanglement PDC QKD are 
still missing. In this paper, we present a model for the entanglement PDC QKD. From the 
model, we find that an entangled PDC source is a basis independent source for QKD. Based 
on this observation, we propose a post-processing scheme by applying Koashi-Preskill's 
security analysis [12 ]. 

Recently, a free-space distribution of entangled photons over 144 km has been demon- 
strated 43j. We simulate this experiment setup and compare three QKD implementations: 



entanglement PDC QKD, triggering PDC QKD and coherent state QKD. In the simulation, 
we also apply Gottesman-Lo two-way post-processing protocol 44J and a recurrence scheme 
451 ] . see also [46]. 

The main contributions of this paper are: 

• We present a model for the entanglement PDC QKD. Although the model is proposed 
to study the entanglement-based QKD, this generic model may also be useful for other 
non-QKD experiments involving a PDC source. 

• From the model, we find that an entangled PDC source is a basis independent source 
for QKD. Based on this observation, we propose a post-processing scheme for the 
entanglement PDC QKD. Essentially, we apply Koashi-Preskill's security analysis 12]. 



By simulating a PDC experiment 43j, we compare three QKD implementations: en- 
tanglement PDC QKD, triggering PDC QKD and coherent state QKD. In the entan- 
glement PDC QKD, we consider two cases: source in the middle and source at Alice's 
side. 



In the case that the PDC source is placed in between Alice and Bob, we find that 
the entanglement PDC QKD can tolerate the highest channel losses, up to 70 dB 
w applying Gottesman-Lo two-way classical communication post-processing protocol 



441 ]. We remark that a 35dB channel loss is comparable to the estimated loss in a 
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satellite to ground transmission in the literature 47], |48j . 



• We consider statistical fluctuations for the entanglement PDC QKD. In this case, the 
PDC setup can tolerate up to 53dB channel loss. 

• The coherent state QKD with decoy states is able to achieve highest key rate in the 
low- and medium-loss regions. 

In Section [IIJ we wm review two experiment setups of the entanglement PDC QKD. In 
Section IHIl we will model the entanglement PDC QKD. In Appendix |Al we calculate the 
quantum bit error rate in the entanglement PDC QKD. In Section IIV| we will propose a 
post-processing scheme for the entanglement PDC QKD. In Section [V] we will compare 
the entanglement PDC QKD, the triggering PDC QKD and the coherent state QKD by 
simulating a real PDC experiment. We also apply protocols based on two-way classical 
communications and consider statistical fluctuations. In Appendix (Bj we investigate the 
optimal \x for the entanglement PDC QKD. 

II. IMPLEMENTATION 

In general, the PDC source does not necessarily belong to one of the two legitimate users 
of QKD, Alice or Bob. One can even assume that an eavesdropper, Eve, owns the PDC 
source. In this section we will compare two experimental setups of the entanglement PDC 
QKD due to the position of the PDC source, in between Alice and Bob or at Alice's side. 

Let us start with a general discussion about an entangled PDC source. With the rotating- 
wave approximation, the Hamiltonian of the PDC process can be written as 2] 

H = t X (^ H b v - a ] v b ] H ) + h.c. (1) 

where h.c. means Hermitian conjugate and \ is a coupling constant depending on the crystal 
nonlinearity and the amplitude of the pump beam. The operators and bi are the annihi- 
lation operators for rectilinear polarizations i G {H, V} in mode a and b respectively. Mode 
a and mode b are the modes sent to Alice and Bob, respectively. 

In the Section 1111} we will focus on modeling the measurement of the rectilinear polariza- 
tion (Z) basis. Due to symmetry, all the calculations can be applied to X basis too. 
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A. Source in the middle 



First we consider the case that the PDC source sits in between Alice and Bob. The 
schematic diagram is shown in FIG. [TJ 
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FIG. 1: A schematic diagram for the entanglement PDC QKD. Alice and Bob connect to a entan- 
gled PDC source by optical links. They each receives one of two entangled modes coming out from 
the PDC source. Both Alice and Bob randomly choose basis (by polarization controllers) to mea- 
sure the arrived signals (by single photon detectors). PC: polarization controller; PBS: polarized 
beam splitter; DAo, DAi, DBo, DBi: threshold detectors. 

As shown in FIG. [IJ a PDC source provides two entangled modes, a and b, which are sent 
to Alice and Bob, respectively. After receiving the signals, Alice and Bob each randomly 
chooses a basis (X or Z) to perform a measurement. One key observation of this setup 
is that the state emitted from the PDC source is independent of the bases Alice and Bob 
choose for the measurements. 



B. Source at Alice's side 

Another case is that Alice owns the PDC source. The schematic diagram is shown in 
FIG. 
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FIG. 2: A schematic diagram for the entanglement PDC QKD. Alice measures one of entangled 
modes coming out from the PDC source and sends Bob the other mode. 



5 



Compare FIG. [T] and [2], we can see that the only difference is the position of the PDC 
source. As we will see in Section IIV| the post-processing these two setups are similar. 

We remark that in the second setup, Alice's measurement commutes with Bob's mea- 
surement. Thus, we have the same observation as before that the PDC source state is 
independent of the measurement bases. 

Therefore, for both setups the entangled PDC source is a basis-independent source. It 
follows that the entanglement PDC QKD is a basis independent QKD. 



III. MODEL 

In this section, we will model entangled PDC sources, channel and detectors for the 
entanglement PDC QKD. We emphasize that this model is applicable for both experiment 
setups described in Section [TTJ 



A. An entangled PDC source 
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From Eq. (pj), the state emitted from a type-II PDC source can be written as 

oo 

= (coshx)~ 2 ^v / ^TTtanh n x|$n), (2) 

n=0 

where |$ n ) is the state of an n-photon-pair, given by 

1 - 

|$ n ) = y^(-l) m \n - m,m) a \m,n -m) b . (3) 

\Jn + 1 *— 1 

v m=0 

For example, when n — 1, Eq. ([3]) will give a Bell state, 

|$ 1 ) = ^=(|l,0) a |0,l) b -|0,l) a |l,0) 6 ) 

f (4) 

= ^=(1 <->)a| l)b ~ I I)a| <">)&), 

Here we use the polarizations |1,0) = | <->) and |0, 1) = | D as a qubit basis (Z basis) for 
QKD. From Eq. ([2]), the probability to get an n-photon-pair is 

Pin) - (n+1)A " (5) 

where we define A = sinh 2 \- The expected photon pair number is fi = 2A, which is the 
average number of photon pairs generated by one pump pulse, characterizing the brightness 
of a PDC source. 
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B. Detection 



We assume that the detection probabilities of the photons in the state of Eq. are in- 
dependent. Define rj A and rj B to be the detection efficiencies for Alice and Bob, respectively. 
Both tja and rj B take into account of the channel losses, detector efficiencies, coupling effi- 
ciencies and losses inside the detector box. For an n-photon-pair, the overall transmittance 
is 

Vn =[l-(l-r lA r][l-(l-ri B n (6) 
We remark that the channel loss is included in t] A and T] B . Thus, this model can be applied 
to either of following two cases: 1) the PDC source is in between Alice and Bob or 2) the 
PDC source is at Alice (or Bob)'s side. 

Yield: define Y n to be the yield of an n-photon-pair, i.e., the conditional probability of a 
coincidence detection event given that the PDC source emits an n-photon-pair. Y n mainly 
comes from two parts, the background and the true signal. Assuming that the background 
counts are independent of the signal photon detection, then Y n is given by 

Y n = [1 - (1 - Y 0A )(1 - VA ) n ][l - (1 - Y QB )(1 - rj B ) n ] (7) 

where Y 0A and Y 0B are the background count rates at Alice's and Bob's sides, respectively. 
The vacuum state contribution is Y = Y 0A Y 0B . The gam of the n-photon-pair Q n , which is 
the product of Eqs. (jSJ and (j7j), is given by 

Q n = Y n P(n) 

(n + i)X n 

= [1 - (1 - Yoa)(1 - VaT][1 - (1 - Y 0B )(1 - Vb) T (1 ^ x ^ +2 . 
The overall gain is given by 

oo 

Qx = Qn 



n=0 



(9) 



;i + « A A) 2 (l + ^A) 2 + + 
Here the overall gain Q\ is the probability of a coincident detection event given a pump 
pulse. Note that the parameter A is one half of the expected photon pair number /i. 
The overall quantum bit error rate (QBER, E\) is given by 

p n _ n 2(e - e d )r] A r]B\(l + A) 

(1 + VaX)(1 + VbX)(1 + VaX + Vb\-VaVb\) 1 J 

where Q\ is the gain given in Eq. (jUJ). The calculation of the E\ is shown in Appendix lAl 



IV. POST-PROCESSING 



As mentioned in Section [TTJ the entanglement PDC QKD is a basis-independent QKD. 
Thus, we can apply Koashi and Preskill's security proof [2]. The key generation rate is 
given by 

R > q{Qx[l - f(5 b )H 2 (8 b ) - H 2 (5 P )]}. (11) 

where q is the basis reconciliation factor (1/2 for the BB84 protocol due to the fact that 
half of the time Alice and Bob disagree with the bases, and if one uses the efficient BB84 

n 

protocol [50(|, q ~ 1), the subscript A denotes for one half of the expected photon number 
/i, Q\ is the overall gain, 5b (5 P ) is the bit (phase) error rate, f(x) is the bi-direction error 
correction efficiency (see, for example, 5l|) as a function of error rate, normally f(x) > 1 
with Shannon limit f(x) = 1, and H 2 (x) is the binary entropy function, 

H 2 {x) = -x log 2 (x) - (1 - x) log 2 (l - x). 

Due to the symmetry of X and Z bases measurements, as shown in Section [Til 5b and 5 P 
are given by 

5 b = 5 P = E x , (12) 

where E\ is the overall QBER. This equation is true for the asymptotic limit of an infinitely 
long key distribution. Later in the Subsection of IV C\ we will see Eq. (fl2|) may not be true 
when statistical fluctuations are taken into account. 



We remark that in Koashi and Preskill's security proof, the squash model [13] is applied. 
In the squash model, Alice and Bob project the state onto the qubit Hilbert space before 
X or Z measurements. For more details of the squash model, one can refer to [131 ] . In the 
case that Alice owns the PDC source, as discussed in Subsection III B[ the key rate formula 
of Eq. fTTTj) has been proven 52j to be valid for the QKD with threshold detectors without 
the squash model, see also 53J. We also notice that this post-processing scheme, Eqs. ( TTTj) 
and ffl2|) . can also be derived from the security analysis based on the uncertainty principle 



54]. 



In Eq. ffTTl) . Q\ can be directly measured from a QKD experiment and E\ can be estimated 
by error testing. In the simulation shown in Section [Vj we will use Eqs. and (fIU|) . 

We remark that the post-processing for the entanglement PDC QKD is simpler than the 
coherent state QKD and triggering PDC QKD. In the entanglement PDC QKD, all the 
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parameters needed for the post-processing (Q\ and Ex) can be directly calculated or tested 
from the measured classical data. In the coherent PDC QKD and the triggering PDC QKD, 
on the other hand, Alice and Bob need to know the value of some experimental parameters 
ahead, such as the expected photon number \i (= 2A), and also need to estimate the gain 
and error rate of the single photon states Q\ and e\, which make the statistical fluctuation 
analysis difficult [28 ]. 

rer improved by introducing two-way classical communi- 



The post-processing can be furt 
cations between Alice and Bob 
performance [3]. 



44 



461 ] . Also, the adding noise technique may enhance the 



V. SIMULATION 



In this section, we will first compare three QKD implementations: entanglement PDC 
QKD, triggering PDC QKD and coherent state QKD. Then we will apply post-processing 
protocols with two-way classical communications to the entanglement PDC QKD. Finally, 
we will consider statistical fluctuations. 

We deduce experimental parameters from Ref. due to the model given in Subsection 
IHIt which are listed in TABLE HI For the coherent state QKD, we use T]a — 1 since Alice 
prepares the states in this case. In the following simulations, we will use q = 1/2 and 
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Repetition rate 


Wavelength 


VAlice 


VBob 


ed 


Y 


249MHz 


710 nm 


14.5% 


14.5% 


1.5% 


6.02 x 10" 6 



431 ] . Here we assume 



TABLE I: Experimental parameters deduced from 144 km PDC experiment 
Alice and Bob use detectors with same characteristics, is the intrinsic detector error rate. Yq is 
the background count rate. rjAUce (rjBob) is the detection efficiency in Alice (Bob)'s box, including 
detector efficiency and internal optical losses. The overall transmittance tja (vb) is the products 
of Alice (Bob)'s channel transmission efficiency and rj Alice {VBob)- 



The optimal expected photon number \x of the coherent state QKD has been discussed 



in Ref. 



281 ] . In Appendix [Bj we investigate the optimal \x (2A) for the entanglement PDC 



QKD. Not surprisingly, we find that the optimal /i for the entanglement PDC QKD is in 



9 



the order of 1, /i = 2 A = 0(1). Thus, the key generation rate given in Eq. (jTTI) depends 
linearly on the channel transmittance. 



A. Comparison of three QKD implementations 

In the first simulation, we assume that Alice is able to adjust the expected photon pair 
number /i (2A, the brightness of the PDC source) in the region of [0,1]. Thus, we can 
optimize /i for the entanglement PDC QKD and the triggering PDC QKD. The simulation 
results are shown in FIG. [3J 
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FIG. 3: (Color online) Plot of the key generation rate in terms of the optical loss, comparing 
comparing four cases: coherent state QKD+aysmptotic decoy, triggering PDC+asymptotic decoy, 
and entanglement PDC QKD (source in the middle and source at Alice's side). For the coherent 
state QKD+decoy, we use t]a = 1- We numerically optimize \i (2A) for each curve. 

From FIG. [3l we have the following remarks. 

1. The entanglement PDC QKD can tolerate the highest channel losses in the case that 
the source is placed in middle between Alice and Bob. 
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2. The coherent state QKD with decoy states is able to achieve the highest key rate 
in the low- and medium-loss region. This is because in the coherent state QKD 
implementation, Alice does not need to detect any photons, which will effectively 
give t]a — 1 in the PDC QKD implementations. 

3. Comparing two cases of the entanglement PDC QKD: source in the middle and source 
at Alice's side, they yields similar key rate in the low- and media- region. But source 
in the middle case can tolerate higher channel losses. 

In the following simulations, we will focus on the case that the entangled PDC source 
sits in the middle between Alice and Bob. 



B. With two-way classical communications 



We can also apply the idea of post-processing with two-way classical communications. 
Similar to the argument of Ref. 46 1, we combine the recurrence idea [45( and the B steps in 
the Gottesman-Lo protocol 44J. The simulation results are shown in FIG. HI 
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FIG. 4: (Color online) Plot of the key generation rate in terms of the optical loss. We apply the 
recurrence idea and up to 3 B steps, [i is numerically optimized for each curve. 
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From FIG. HJ we can see that the recurrence scheme can increase the key rate by around 
10% and extend the maximal tolerable loss by around ldB. The PDC experiment setup 
can tolerate up to 70dB channel loss with 3 B steps. We remark that 70dB (35dB in each 



47 



channel) is comparable to the estimated loss in a satellite to ground transmission 
This result suggests that satellite-ground QKD may be possible. However, this simulation 
assumes the ideal situation that an infinite number of signals are transmitted. Moreover, 
we assume that \i (the brightness of the PDC source) is a freely adjustable parameter in the 
PDC experiment. In a more realistic case where a finite number of signals are transmitted 
and \x is a fixed parameter, the tolerable channel loss becomes smaller, as we show next. 

C. Statistical fluctuations 



In Eq. (112 j) . we assume that 5b and 5 P are the same due to the symmetry between X 
and Z measurements. Alice and Bob randomly choose to measure in X or Z basis. Then 
asymptotically, 5b is good estimate of 5 P . However, in a realistic QKD experiment, only a 
finite number of signals are transmitted. Thus 5 p may slightly differ from 5b- We assume 
that Alice and Bob do not perform error testing explicitly. Instead, they obtain the bit error 
rate directly from an error correction protocol (e.g., the Cascade protocol |51|)- In that case, 
there is no fluctuation in the bit error rate 5b = E\. On the other hand, the phase error 
rate may fluctuate to some certain value 5 P = 5b + e. Following the fluctuation analysis of 
Ref. [5(, we know that the probability to get a e bias is 

P ' £ exp| -4MT^l. (13) 

where n = NQ\ the number of detection events, the product of total number of pulses N 
and the overall gain Q\. 

In the 144km PDC experiment [43 , the repetition rate of pump pulse is 249MHz as given 
in TABLE [H As discussed in Ref. [48[ , the typical time of ground-satellite QKD allowed by 
satellite visibility is 40 minutes. Here, we assume the experiment runs 10 minutes, which 
means the data size is N = 1.5 x 10 11 . By taking this data size, we consider the fluctuations 
for the entanglement PDC QKD. 

In the realistic case, the brightness of the PDC source fi cannot be set freely. In the 144 



km PDC experiment 



431 ] . the expected photon pair number is fi = 2A = 0.053. After taking 
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[i = 0.053 and the data size of N = 1.5 x 10 11 for the fluctuation analysis, the simulation 
result is shown in FIG. |5j 
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FIG. 5: (Color online) Plot of the key generation rate in terms of the optical loss. We take a 
realistic fi = 2A = 0.053, and consider the fluctuation with a data size of N = 1.5 x 10 11 and a 
confident interval of 1 — P f > 1 
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We have a couple remarks on FIG. [5J 

1. In FIG. El if we cut off from the key rate of 10" 10 (57|, the entanglement PDC QKD 
with one B step can tolerate up to 53dB transmission loss. 

2. We have tried simulations with various /x's. We find that the key rate is stable with 
moderate changes of /i. With above fluctuation analysis, if we numerically optimize 
\i for each curve, the maximal tolerable channel loss (with cut off key rate of 10~ 10 ) 
is only ldB larger than the one given by fi = 0.053. Thus, one cannot significantly 
improve the maximal tolerable channel loss by just using a better PDC source in the 



144km PDC experiment setup 



43]. 
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VI. CONCLUSION 



We have proposed a model and post-processing for the entanglement PDC QKD. We find 
that the post-processing is simple by applying Koashi-Preskill's security proof due to the fact 
that the entanglement PDC QKD is a basis independent QKD. Specifically, only directly 
measured data (the overall gain and the overall QBER) are needed to perform the post- 
processing. By simulating a recent experiment, we compare three QKD schemes: coherent 
state QKD+aysmptotic decoy, triggering PDC+asymptotic decoy, and entanglement PDC 
QKD (source in the middle and at Alice's side). We find that a) the entanglement PDC 
(with source in the middle) can tolerate the highest channel loss; b) the coherent state QKD 
with decoy states can achieve the highest key rate in the medium- and low-loss regions; 
c) asymptotically, with a realistic PDC experiment setup, the entanglement PDC QKD 
can tolerate up to 70 dB channel losses by applying post-processing schemes with two-way 
classical communications; d) the PDC setup can tolerate up to 53 dB channel losses when 
statistical fluctuations are taken into account. 
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APPENDIX A: QUANTUM BIT ERROR RATE 

Here we will study the quantum bit error rate (QBER) of the entanglement PDC QKD. 
Our objective is to derive the QBER formula given in Eq. ( ITUl) used in the simulation. The 
QBER has three main contributions: 
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1. background counts, which are random noises eo = 1/2; 

2. intrinsic detector errors, e<j, which is the probability that a photon hit the erroneous 
detector, a characterizes the alignment and stability of the optical system between 
Alice's and Bob's detection systems; 



3. errors introduced by multi-photon-pair states: a) Alice and Bob 



may detect different 



photon pairs; b) double clicks. Due to the strong pulsing attack [56j, we assume that 
Alice and Bob will assign a random bit when they get a double click. In either case, 
the error rate will be eo = 1/2. 

Let us start with the single-photon-pair case, a Bell state given in Eq. (j3j). The error rate 
of single-photon-pair e\ has two sources: background counts and intrinsic detector errors, 

(eo - e d )7] A r] B 

ei = e - (Al) 

If we neglect the case that both background and true signal cause clicks, then e± can be 
written as 

e (Y 0A Y 0B + Y oa i]b + tiaYob) + e d r] A r] B 
d « - . (A2) 

where eo = 1/2 is the error rate of background counts. The first term of the numerator is 
the background contribution and the second term comes from the errors of true signals. 

In the following, we will discuss the errors introduced by multi-photon pair states, e n 
with n > 2. Here we assume Alice and Bob use threshold detectors, which can only tell 
whether the incoming state is vacuum or non- vacuum. One can imagine the detection of an 
n-photon-pair state as follows. 

1. Alice and Bob project the n-photon-pair state, Eq. (J3J), into Z m basis. 

2. Afterwards, they detect each photon with certain probabilities (r] A for Alice and t)b 
for Bob). 

3. If either Alice or Bob detects vacuum, then we regard it as a loss. If Alice and Bob 
both detect non- vacuum only in one polarization (<-> or J), we regard it as a single 
click event. Otherwise, we regard it as a double click event. 
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The state of a 2-photon-pair state, according to Eq. ([3]), can be written as 
|$ 2 > = -4(|2,0) o |0,2) 6 - |l,l) o |l,l)6+|0,2) o |2,0) 6 



V3 

[i <-><->>«! ii)6 - ;(i -i) + 1 :<->». ® (i :<->> + 1 <-t» 6 + 1 n>.i <-><-> >j. 



, , (A3) 



v/3 l 

As discussed above, Alice and Bob project the state into Z <g> Z basis. If they end up with 
the first or the third state in the bracket of Eq. (1A3|) . they will get perfect anti-correlation, 
which will not contribute to errors. If they get the second state in the bracket of Eq. (1A3I) . 
their results are totally independent, which will cause an error with probability eo = 1/2. 
Thus the error probability introduced by a 2-photon-pair state is 1/6. Here we have only 
considered the errors introduced by multi photon states, item 3 discussed in the beginning 
of this Appendix. We should also take into account the effects of background counts and 
intrinsic detector errors. With these modifications, the error rate of 2-photon-pair state is 
given by 

Cz _ Cu 2(e -e d )[l-(l-r M ) 2 ][l-(l-r /i? ) 2 ] {M) 

where Y 2 is given in Eq. (J7|). Eq. (1A4D can be understood as follows. Only when Alice 
and Bob project the Eq. (|A3[) into | <-M-») a | XX) b or | JJ) a | ^^)b and no background 
count occurs, they have a probability of e^ to get the wrong answer. Given a coincident 
detection, the conditional probability for this case is 2[1 — (1 — ?7yi) 2 ] [1 — (1 — 77#) 2 ]/3Y2- All 
other background count, a double click and measuring different photon pairs, will 

contribute an error probability eo = 1/2. 

Next, let us study the errors coming from the state \n — m, m) a \m, n — When Alice 
detects at least one of n — m | |) photons but none of m \ <->) photons, and Bob detects at 
least one of n — m \ <->) photons but none of m \ |) photons, or both Alice and Bob have 
bit flips of this case, they will end up with an error probability of e^. Given a coincident 
detection, the conditional probability for these two cases is 

i{[i - (i - VA r~ m ](i - VA) m [i - a - ^r m ]a - vbT i 

+ [1 - (1 - r] A ) m }(l - r ?A ) m " m [l - (1 - VB ) m ](l - VbT'" 1 }- 

When Alice detects at least one oin — m \ J) polarizations but none of m \ <->) polarizations, 
and Bob detects at least one of m \ |) polarizations but none of n — m \ <->) polarizations, 
or both Alice and Bob have bit flips of this case, they will end up with an error probability 
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of 1 — e d - Given a coincident detection, the conditional probability for these two case is 

^{[i - (i - VA ) m ](i - r/ A )- m [i - (i - VB r~ m ](i - VB r 

+ [1 - (1 - VA ) n - m }(l ~ VA) m [l - (1 - r, B ) m )(l - VB) n - m }. 

For all other cases, the error probability is cq. Thus the error probability for the state 
|n — m, m) a \m, n — m)b is 

e nm =e - ^t^{(1 - VA) n - m (l - VB) n - m [l - (1 - VA) m ][l ~ (1 - VbT] 

1 n 

+ (1 - ^) m (l - VB ) m [l - (1 - r /A )"- m ][l - (1 - 77s)"—] 

- (1 - VA ) n - m (l - VB ) m [l - (1 - 77A) m ][l - (1 - ^)"~ m ] (A5) 

- (1 - r, A r(l - VB r- m [l - (1 - VA) n ~ m ][l - (1 - r/ B ) m ]} 

=eo - ^^[(1 - VA) n - m - (1 - ^) m ][(l - - (1 - ^) m ] 

In general, for an n-photon-pair state described by Eq. ([3]), the error rate is given by 
1 

7 e r- 

n + 1 ^ 

m=0 

E e - ^^[(1 - VA) n - m - (1 - [(1 - VB) n ' m - (1 - i7 fl ) 



n , . 

m=0 



(A6) 



e 



eo - e d 



E tc 1 - ^)"" m - C 1 - [C 1 - ^) n ~ m - ( x - 

m=0 

2(e - e d ) A - (1 - - r/ B )" +1 (1 - - (1 - 



(n + l)Y n 

r 

e - ^ 



(n + l)Y n 1 - (1 - r] A )(l - r] B ) Vb-Va 
The overall QBER is given by 



E x Q x =J2e n Y n P( 

n=0 

oo 

=e <5A - E 



n=0 

2(e - e d )X n A - (1 - - Vs) n+1 (1 - ^) n+1 - (1 - Vb) 



n+l 



n=Q 



(1 + A)"+ 2 L 1- (l-TMXl-^) VB-VA 



2(e - e d )-q A r] B X{l + A) 



(1 + 77aA)(1 + 77ijA)(l + r] A X + r] B X - r] A r] B X) 

(A7) 



where Q\ is the gain given in Eq. (J9j). 
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APPENDIX B: OPTIMAL // 



The optimal fi for the coherent state QKD has already been discussed [8j, |28|] . Here we 
need to find out the optimal /i for the entanglement PDC QKD. In the following calculation, 
we will focus on optimizing the parameter A (= /x/2) for the key generation rate given in 
Eq. (TH]). 

By assuming r/^ to be small and neglecting Y , we can simplify Eq. (Q 

(B1) 

The overall QBER given in Eq. (flOl) can be simplified to 

F ~ 1 (l-2e d )(l + A)(l + iMA) , R , 

A ~2 2(l + 3A + 3r ?A A 2 + r/iA3)- ^ 

In order to maximize the key generation rate, given by Eq. pip , the optimal A satisfies 

^[1 - (1 + f(E x ))H 2 (E x )\ - Q x [l + /(JB A )]^log a = 0. (B3) 

Here we treat f(E\) as a constant. In the following we will consider two extremes: tja ~ 1 
and 77^4 <C 1. 

When tja ~ 1, the overall gain and QBER are given by 



2e d + A 



(B4) 



E 



A 



2 + 2A 

Thus, Eq. ( 1B3[) can be simplified to 



1 - [1 + f(E x )]H 2 (E x ) - A[l + /(^a)]^^ log 2 = 0. (B5) 



When t\a •< 1, 

Qa « 2^ b A(1 + 3A) 
e d + A + e d X 



(B6) 



-A 



1 + 3A 

Thus, Eq. (IB3P can be simplified to 



(1 + 6A){1 - [1 + f(E x )]H 2 (E x )} - A[l + f(E x )]?—^ log 2 = 0. (B7) 

The solutions to Eqs. (1B5P and (1B7P are shown in FIG. O 
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0.25 




FIG. 6: Plot of the optimal /i in terms of for the entanglement PDC QKD. /(e^) = 1.22. 

From FIG. [fU we can see that the optimal \i — 2A for the entanglement PDC is in the 
order of 1, fi = 2A = 0(1), which will lead the final key generation rate to be R = 0(?7a?7b). 
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